DDOS attacks for small outfits are hard to fight. I've read in places some people combat DDOS attacks by having bandwidth much larger than any DDOS attack can saturate. I don't think that is feasible for a small outfit. What do you do when under a DDOS attack?

Somebody else asks how to big co's solve the problem at SANS. Perhaps their answer will apply to smaller firms as well (fingers crossed), unlike the solution I've pointed out above.